v0.3.0

Evidence you can check, and a corpus that says what it does not know.

Upgrading

Workspaces created before v0.3.0 accept no new records. ADR-0005 binds every
record to a source/transcript/timing revision, and a workspace that predates
those bindings is read-only for new evidence. Any command that appends a durable
record — a checkpoint, an edit decision, a diarized speaker turn, captured-image
provenance — refuses there:

RevisionBindingError: legacy workspace is read-only for new evidence;
ingest into a fresh revision-bound workspace before appending records

Everything already recorded stays readable. Commands that only read or derive
(va audit, va search, va index, va view, va wiki, va status) are
unaffected, and so is the NLE handoff: va export skips the decoded-CFR proof
when a workspace carries no source revision.

This release ships no migration command. va audit now names the split
(binding_counts in --json), so a frozen corpus is visible up front instead
of surfacing later as a rejected write. To keep analyzing a frozen video,
re-ingest it to a fresh -o path; the new workspace is bound and accepts
records.

In-place promotion is deferred to 0.4.0 because the obvious implementation
destroys what it is meant to save. Manifests written before v0.3.0 mostly lack
the stream-timing block the temporal contract requires, so switching the
contract on makes every existing line fail validation, and the readers skip
invalid lines by design — a measured trial dropped every checkpoint and
sequence in the workspace to zero. Promotion must therefore re-probe sources
first and roll back on a post-condition check.

Integrity

• Revision-bound workspaces (ADR-0005). Re-ingest used to replace only manifest.json and transcript.json while keeping checkpoints, sequences and export receipts. Transcript support validated segment IDs and time overlap — not transcript content or generation — so an old claim could appear supported by unrelated new text. Ingest now seals the source bytes before transcription, publishes content-derived source/transcript/timing revisions, and binds every new record to them. A published workspace is immutable to ingest; re-transcription uses a fresh -o path.
• Diarization is crash-recoverable. Rewriting canonical transcript segments takes an exclusive lease and journals the prior state; a process loss is rolled back idempotently on the next load.

Handoff

• The decoded-CFR proof is persisted. Revision-bound EDL/XML/FCPXML/OTIO requires proving the whole decoded timeline against one rational cadence. That proof lived only in memory, so every export re-enumerated every frame. It is now bound to the source content hash and timing revision: the same handoff drops from 80.71 s to 0.12 s on a 757.6 s AV1 source, with byte-identical output.
• Constant-rate video with a longer audio track is no longer blocked. Frame-count verification compared against the container duration, which is the maximum across all streams. A 30 s video carrying 33 s of audio expected 990 frames and found 900, so the handoff failed closed on perfectly regular video. Verification now uses the video stream's own length.

Observability

• va audit prints both evidence axes. Declared (what a checkpoint cited) and grounded (whether that evidence resolves now) are shown side by side, and the grounded axis names unsupported terminal checkpoints — including zero. Printing only the permissive axis made a corpus read as fully grounded when 46 of 165 terminal checkpoints had no resolvable support.
• va wiki states what it could not carry. The wiki only admits claims whose evidence resolves; it now reports how many terminal checkpoints were left out and which workspaces they came from. An unexplained absence reads as "that never happened".
• Corpus reads are recorded. search, index, view and wiki append to a read ledger, so whether the knowledge is actually used is observable. Query text is never stored — only a hash, its length, and the hit count. Zero-hit reads are counted separately: they are questions the corpus could not answer.
• Entity slug reassignment is gated. Slug assignment depends on the pages already on disk, so ingestion order can hand an existing filename to a different entity. The link stays valid while its target changes, which broken-link checks cannot see by construction. Regeneration now records the mapping and reports reassignment.

View

• Silent playback failure now speaks. A workspace whose source lives outside it points at a file:// path. Served over http, the browser blocks that media and the player showed a black frame with no explanation. The page detects the protocol mismatch and says what to do.
• The graph shares the list filter instead of drawing every workspace while the table reads "3 of 39", and labels avoid collisions instead of overprinting each other.

Install

git clone https://github.com/mupozg823/timecode-agent.git && cd timecode-agent
uv tool install --python 3.12 .          # add '.[diarize]' for pyannote diarization

Requires ffmpeg/ffprobe on PATH, plus yt-dlp for URL ingest. See the README (한국어).

Full Changelog: v0.2.0...v0.3.0